Filter
Top Products
A-2 APPENDIX A: PACKET FILTER OPCODES, EXAMPLES, AND SYNTAX ERRORS
pushField.size <offset>
Description:
Pushes a field from the target packet onto the stack. Packet data starting at
<offset> is copied onto the stack. The most significant byte of the field is the
byte at the specified offset. The number of bytes pushed is determined by the
size field of the instruction. The pushField instruction provides direct access to
any 1, 2, 4, or 6 byte field contained within the first 65535 bytes of the target
packet.
Certain implementations of the packet filter language further limit the maximum
offset, based on the packet lengths supported by the underlying network.
Ethernet-based packet filters are limited to accessing fields in the first 1518 bytes
of the target packet.
Specify the offset as either an octal, decimal, or hexadecimal number.
■ Precede an octal number by a “0”.
■ Precede a hexadecimal number by either “0x” or “0X”.
■ Use either upper or lower case letters for the hexadecimal digits “a”
through “f”.
Storage Needed:
3 bytes
pushLiteral.size <value>
Description:
Pushes a literal constant <value> onto the stack. The most significant byte of the
<value> is the first byte of the literal. Bytes are copied directly from the
instruction stream onto the stack. The number of bytes pushed is determined by
the size field of the instruction.
Specify the value as either an octal, decimal, or hexadecimal number.
■ Precede an octal number by a “0”.
■ Precede a hexadecimal number by either “0x” or “0X”.
■ Use either upper or lower case letters for the hexadecimal digits “a”
through “f”.
Storage Needed:
1 (.b), 2 (.w), 4 (.l), or 6 (.a) bytes—depending on the size of the operand